CVE-2025-40293
Description
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Don't overflow during division for dirty tracking
If pgshift is 63 then BITS_PER_TYPE(*bitmap->bitmap) * pgsize will overflow to 0 and this triggers divide by 0.
In this case the index should just be 0, so reorganize things to divide by shift and avoid hitting any overflows.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Integer overflow in iommufd dirty tracking can cause divide-by-zero when pgshift is 63, leading to a kernel crash.
Vulnerability
Analysis In the Linux kernel's iommufd subsystem, a flaw in dirty tracking calculations can lead to an integer overflow when pgshift is 63. The division operation BITS_PER_TYPE(*bitmap->bitmap) * pgsize overflows to zero, causing a divide-by-zero error [1].
Exploitation
This vulnerability is triggered locally when pgshift is set to 63 during dirty tracking configuration. No special privileges are required beyond normal access to iommufd operations. The overflow results in a division by zero, which likely causes a kernel panic [2].
Impact
A successful exploitation results in a denial of service (DoS) via kernel crash. There is no evidence of privilege escalation or arbitrary code execution from this bug.
Mitigation
The fix reorganizes the calculation to divide by shift first, avoiding the overflow. Patches are available in stable kernel updates [1][2].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
507105e61882f4c8a4f1d34ecde7f2c67ceb1dbf316fc90aacb30dfa75d55Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- git.kernel.org/stable/c/07105e61882ff4a7d58db63cc5f9e90c6c60506cnvd
- git.kernel.org/stable/c/4c8a4f1d34eced168cc0b3a3dfe7b6dcc2090f69nvd
- git.kernel.org/stable/c/cb30dfa75d55eced379a42fd67bd5fb7ec38555envd
- git.kernel.org/stable/c/dbf316fc90aa954dcd5440817f4b944627ed63e0nvd
- git.kernel.org/stable/c/de7f2c67ceb1941b05b04ac35458a03e93cc57b1nvd
News mentions
0No linked articles in our index yet.